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1. Real Party In Interest 

The real party in interest, in addition to the inventors, Cary L. Bates and Paul W. 
Buenger, is the assignee. International Business Machines Corporation, a corporation 
organized and existing under and by virtue of the laws of the State of New York, and having 
an office and place of business at New Orchard Road, Armonk, New York 10504. 
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2. Related Appeals and Interferences 
There are no other prior or pending appeals, interferences, or judicial proceedings, 
which may be related to, directly affect or be directly affected by, or have a bearing on the 
Board's decision. 
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3. Status of Claims 

On January 21 , 2009, appellant appealed from the final rejection of claims 1 -5 made 
in the Final Office Action dated September 17, 2008. Claims 6-20 were canceled without 
prejudice or disclaimer. Finally rejected claims 1-5 on appeal are set forth in the Claims 
Appendix. 
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4. Status of Amendments 
Subsequent to the Final Office Action dated September 17, 2008, appellant did not 
file any amendments. 
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5. Smnmarv of Claimed Subject Matter 



As described, by way of example and not of limitation, at page 3, lines 1-8 of 
appellant's specification and as illustrated, by way of example and not of limitation, at Fig. 1, 
elements 101, 102, 170, 172, 174, and 176, at Fig. 2, elements 200, 205, 210, 215, and 220, at 
Fig, 3A, elements 172, 305, 310, 315, and 320, at Fig. 3B, elements 174, 355, 360, 365, and 
370, at Fig. 4A, elements 176-1 and 405, at Fig. 4B, elements 176-2 and 450, at Fig. 5, 
elements 515, 520, 530, 535, 540, and 550, at Fig. 6A, elements 605, 610, 615, 620, 625, 630, 
635, 640, and 645, and at Fig. 6B, elements 650, 655, 660, 665, and 670, "A method . . . [is] 
provided that in an embodiment determine[s] whether a password is restricted to a set of 
pages, deny submission of the password outside the set of pages if the password is restricted, 
and allow submission of the password outside the set of pages if the password is not 
restricted. In various embodiments, the set of pages includes all pages in a domain or only a 
single page. In various embodiments, restriction of the password may be specified via 
control information in a page or via a user interface." 

With reference to claim 1, an embodiment of the invention comprises a method, 
which is described, by way of example and not of limitation, in the specification, at page 3, 
line 2, at page 4, lines 14-27, at page 5, lines 1-26, at Fig. 1, elements 101, 102, 170, and 172, 
at Fig. 5, elements 505, 510, 515, 520, 525, 530, 535, 540, and 550, at Fig. 6A, elements 605, 
610, 615, 620, 625, 630, 635, 640, and 645, and at Fig. 6B, elements 650, 655, 660, 665, and 
670. 

The method of claim 1 comprises receiving a form at a client, wherein the form 
requests that a first password be submitted to a server, which is described, by way of example 
and not of limitation, in the specification, at page 1, lines 17-19, at page 2, lines 23-24, at 
page 4, lines 6-9, at page 7, lines 19-22, at page 12, lines 4-8, at page 13, lines 1-1 1 and 25- 
28, at page 14, lines 1-5, at Fig. 1, elements 100, 101, 102, 160, 170, and 172, at Fig. 5, 
elements 505, 510, 530, and 535, and at Fig. 6A, elements 605, 610, and 615. 

With further reference to claim 1 , the method further comprises determining whether 
the first password is restricted to a set of pages, wherein the determining further comprises in 
response to each of the pages in the set being retrieved from the server, determining whether 
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at least one of the pages in the set comprises a meta tag that includes password restriction 
control information that specifics an address of a domain and restriction of password 
submission to within the domain, wherein the pages in the set are interpreted and displayed at 
the client after being retrieved from the server, which is described, by way of example and 
not of limitation, in the specification, at page 1, lines 17-19, at page 2, lines 22-26, at page 3, 
lines 2-8, at page 5, lines 15-26, at page 7, lines 15-26, at page 10, lines 12-27, at page 1 1, 
lines 1-8 and 21-26, at page 12, lines 4-26, at Fig. 1, elements 100, 101, 102, 121, 122, 123, 
124, 160, 168, 170, 172, 174, and 176, at Fig. 2, elements 205 and 210, at Fig. 3A, elements 
172, 305, 310, 315, and 320, at Fig. 3B, elements 174, 360, 365, and 370, at Fig. 4A, 
elements 176-1 and 405, and at Fig. 5, elements 505, 510, 515, 520, and 525. 

Wifli fiiriher reference to claim 1 , the method further comprises if the first password is 
restricted to the set of pages, denying submission of the first password outside the set of 
pages, wherein the first password is allowed to be submitted to the server that originated the 
set of pages, which is described, by way of example and not of limitation, in the specification, 
at page 3, lines 1-5, at page 10, lines 12-27, at page 1 1, lines 1-29, at page 12, lines 1-29, at 
page 13, lines 1-12 and 25-28, at page 14, lines 1-28, at page 15, lines 1-28, at page 16, lines 
1-8, at Fig. 2, elements 205, 210, 215, and 220, at Fig. 3A, elements 172, 305, 310, 315, and 
320, at Fig. 3B, elements 174, 355, 360, 365, and 370, at Fig. 4A, elements 176-1 and 405, at 
Fig. 5, elements 505, 510, 530, and 535, at Fig. 6A, elements 605, 610, 615, 620, 625, 630, 
635, and 640, and at Fig. 6B, elements 650, 655, 660, 665, and 670. 

With fiirther reference to claim 1, the method further comprises if the first password is 
not restricted to the set of pages, allowing submission of the password outside the set of 
pages, which is described, by way of example and not of limitation, in the specification, at 
page 3, lines 1-5, at page 10, lines 12-27, at page 1 1 , lines 1-29, at page 12, lines 1-29, at 
page 13, lines 1-12 and 25-28, at page 14, lines 1-28, at page 15, lines 1-28, at page 16, lines 
1-8, at Fig. 2, elements 205, 210, 215, and 220, at Fig. 3A, elements 172, 305, 310, 315, and 
320, at Fig. 3B, elements 174, 355, 360, 365, and 370, at Fig. 4A, elements 176-1 and 405, at 
Fig. 5, elements 505, 510, 530, and 535, at Fig. 6A, elements 605, 610, 615, 620, 625, 630, 
635, and 640, and at Fig. 6B, elements 650, 655, 660, and 665. 
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With further reference to claim 1, the method further comprises denying submission 
of a second password inside the set of pages if the second password was previously submitted 
outside the set of pages, which is described, by way of example and not of limitation, in the 
specification, at page 3, lines 1-5, at page 10, lines 12-27, at page 11, lines 1-29, at page 12, 
lines 1-29, at page 13, lines 1-12 and 25-28, at page 14, lines 1-28, at page 15, lines 1-28, at 
page 16, lines 1-8, at Fig. 2, elements 205, 210, 215, and 220, at Fig. 3A, elements 172, 305, 
310, 315, and 320, at Fig. 3B, elements 174, 355, 360, 365, and 370, at Fig. 4A, elements 
176-1 and 405, at Fig. 5, elements 505, 510, 530, and 535, at Fig. 6A, elements 605, 610, 
615, 620, 625, 630, 635, and 640, and at Fig. 6B, elements 650, 655, 660, 665, and 670. 

With further reference to claim 1 , the method further comprises allowing submission 
of the second password inside the set of pages if the second password was not previously 
submitted outside the set of pages, which is described, by way of example and not of 
limitation, in the specification, at page 3, lines l-5,atpage 10, lines 12-27,atpage 11, lines 
1-29, at page 12, lines 1-29, atpage 13, lines 1-12 and 25-28, at page 14, lines 1-28, at page 
15, lines 1-28, at page 16, lines 1-8, at Fig. 2, elements 205, 210, 215, and 220, at Fig. 3A, 
elements 172, 305, 310, 315, and 320, at Fig. 3B, elements 174, 355, 360, 365, and 370, at 
Fig. 4A, elements 176-1 and 405, at Fig. 5, elements 505, 510, 530, and 535, at Fig. 6A, 
elements 605, 610, 615, 620, 625, 630, 635, and 640, and at Fig. 6B, elements 650, 655, 660, 
665, and 670. 

With further reference to clam 1 , the method further comprises if the at least one of 
the pages in the set comprises the password restriction control information that specifies the 
address of the domain and the restriction of the password submission to within the domain, 
saving the address of the domain and saving an indication that password use is to be restricted 
for all the pages in the domain pages, which is described, by way of example and not of 
limitation, in the specification, atpage 3, lines 1-5, atpage 10, lines 12-27, at page 11, lines 
1-29, at page 12, lines 1-29, at page 13, lines 1-12 and 25-28, at page 14, lines 1-28, at page 
15,lines 1-28, atpage 16, lines 1-8, at Fig. 3A, elements 172, 305, 310, 315, and 320, at Fig. 
3B, elements 174, 355, 360, 365, and 370, at Fig. 4A, elements 176-1 and 405, at Fig. 5, 
elements 505, 510, 515, and 520. 
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With reference to claim 2, the set of pages comprises all pages within the domain, 
which is described, by way of example and not of limitation, in the specification, at page 3, 
lines 2-7, at page 10, lines 21, at page 16, lines 5-8, at Fig. 1, element 176, and at Fig. 4A, 
elements 176-1 and 405. 

With reference to claim 3, the set of pages comprises a single page, which is 
described, by way of example and not of limitation, in the specification, at page 3, lines 2-7, 
at page 10, lines 21 , at page 16,-lines 5-8, and at Fig. 1 , element 176, and at Fig. 4B, elements 
176-2 and 450. 

With reference to claim 4, the method fiirther comprises presenting a dialog at the 
client, wherem the dialog allows a user to specify an address of a domain for which password 
submission is to be restricted, which is described, by way of example and not of limitation, in 
the specification, at page 1, lines 17-19, at page 7, lines 19-22, at page 10, lines 12-25, at Fig. 
1, elements 100, 121, 122, 123, and 124, and at Fig. 2, elements 200, 205, and 210. 

With reference to claim 5, the method further comprises presenting a dialog at the 
client, wherein the dialog allows a user to specify an address of a single page for which 
password submission is to be restricted, which is described, by way of example and not of 
limitation, in the specification, at page 1, lines 17-19, at page 7, lines 19-22, at page 10, lines 
12-25, at Fig. 1, elements 100, 121, 122, 123, and 124, and at Fig. 2, elements 200, 215, and 
220. 
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6. Grounds of Rejection to be Reviewed on Appeal 



1. Whether claims 1-5 are mipatentable under 35 U.S.C. 102(e) over Wood (US 
Patent Number 6,609,198). 
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7. Argument 

A) The Applicable Law 

Anticipation requires the disclosure in a single prior art reference of each element of 
the claim under consideration. In re Dillon 919 F.2d 688, 16 USPQ 2d 1897, 1908 (Fed. Cir. 
1990) (en banc), cert, denied, 500 U.S. 904 (1991). It is not enough, however, that the prior 
art reference discloses all the claimed elements in isolation. Rather, "[a]nticipation requires 
the presence in a single prior reference disclosure of each and every element of the claimed 
invention, arranged as in the claim" Lindemann Maschinenfabrik GmbH v. American Hoist 
& Derrick Co., 730 F.2d 1452, 221 USPQ 481, 485 (Fed. Cir. 1984) (citing Connell v. Sears, 
Roebuck & Co., 722 F.2d 1542, 220 USPQ 193 (Fed. Cir. 1983)) (emphasis added). "The 
identical invention must be shown in as complete detail as is contained in the ... claim." 
Richardson v. Suzuki Motor Co., 868 F.2d 1226, 1236, 9 USPQ2d 1913, 1920 (Fed. Cir. 
1989); MPEP§2131. 

The Examiner has the burden under 35 U.S.C. § 103 to establish a prima facie case of 
obviousness. In re Fine, 837 F.2d 1071, 1074, 5 USPQ2d 1596, 1598 (Fed. Cir. 1988). To 
do that the Examiner must show that some objective teaching in the prior art or some 
knowledge generally available to one of ordinary skill in the art would lead an individual to 
combine the relevant teaching of the references. Id. 

The Fine court stated that; 

Obviousness is tested by "what the combined teaching of the references 
would have suggested to those of ordinary skill in the art." In re Keller, 642 
F.2d 413, 425, 208 USPQ 871, 878 (CCPA 1981). But it "cannot be 
established by combining the teachings of the prior art to produce the claimed 
invention, absent some teaching or suggestion supporting the combination." 
ACSHosp. Sys., 732 F.2d at 1577, 221 USPQ at 933. And "teachings of 
references can be combined only if there is some suggestion or incentive to do 
so." Id. (emphasis in original). 

In order for the Examiner to establish a prima facie case of obviousness, three base 
criteria must be met. First, there must be some suggestion or motivation, either in the 
references themselves or in the knowledge generally available to one of ordinary skill in the 
art, to modify the reference or to combine reference teachings. Second, there must be a 
reasonable expectation of success. Finally, the prior art reference (or references when 
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combined) must teach or suggest all the claim limitations. The teaching or suggestion to 
make the claimed combination and the reasonable expectation of success must both be found 
in the prior art, and not based on applicant's disclosure. In re Vaeck, 947 F.2d 488, 20 
USPQ2d 1438 (FedCir. 1991). 

An invention can be obvious even though the suggestion to combine prior art 
teachings is not found in a specific reference. In re Oetiker, 24 USPQ2d 1443 (Fed. Cir. 
1992). At the same time, however, although it is not necessary that the cited references or 
prior art specifically suggest making the combination, there must be some teaching 
somewhere which provides the suggestion or motivation to combine prior art teachings and 
applies that combination to solve the same or similar problem which the claimed invention 
addresses. One of ordinary skill in the art will be presumed to know of any such teaching. 
(See, e.g., In re Nilssen, 851 F.2d 1401, 1403, 7 USPQ2d 1500, 1502 (Fed. Cir. 1988) and In 
re Wood, 599 F.2d 1032, 1037. 202 USPQ 171, 174 (CCPA 1979)). 

A factor cutting against a finding of motivation to combine or modify the prior art is 
when the prior art teaches away from the claimed combination. A reference may be said to 
teach away when a person of ordinary skill, upon reading the reference, would be 
discouraged from following the path set out in the reference, or would be led in a direction 
divergent from the path the applicant took. In re Gurley, 27 F.3d 55 1 , 3 1 USPQ 2d 1 1 30, 
1131 (Fed. Cir. 1 994); United States v. Adams, 383 U.S . 39, 52, 148 USPQ 479, 484 (1 966); 
In re Sponnoble, 405 F.2d 578, 587, 160 USPQ 237, 244 (C.C.P.A. 1969); In re Caldwell, 
319 F.2d 254, 256, 138 USPQ 243, 245 (CCPA. 1963). 

The test for obviousness under § 103 must lake into consideration the invention as a 
whole; that is, one must consider the particular problem solved by the combination of 
elements that define the invention. Interconnect Planning Corp. v. Feil, 11 A F.2d 1 132, 
1 143, 227 USPQ 543, 551 (Fed. Cir. 1985). Furthermore, claims must be interpreted in light 
of the specification, claim language, other claims and prosecution history. Panduit Corp. v. 
Dennison Mfg. Co., 810 F2d 1561, 1568, 1 USPQ2d 1593, 1597 (Fed. Cir. 1987), cert, 
denied, 481 U.S. 1052 (1987). At the same time, a prior patent cited as a § 103 reference 
must be considered in its entirety, "/.e. as a whole, including portions that lead away from the 
invention." Id. That is, the Examiner must, as one of the inquiries pertinent to any 



Appellant: Gary L. Bates Page 16 

Serial No.; 10/798,909 

Filed: March 11, 2004 Docket: ROC920030376US 1 

Title: Password Protection Mechanism 

obviousness inquiry under 35 U.S.C. § 103, recognize and consider not only the similarities 
but also the critical differences between the claimed invention and the prior art. In re Bond, 
910 F.2d 831, 834, 15 USPQ2d 1566, 1568 (Fed. Cir. 1990), reh'g denied, 1990 U.S. App. 
LEXIS 19971 (Fed. Cir. 1990). Finally, the Examiner must avoid hindsight. Id. 

The express, implicit, and inherent disclosures of a prior art reference may be relied 
upon in the rejection of claims under 35 U.S.C. 102 or 103. But, the fact that a certain result 
or characteristic may occur or be present in the prior art is not sufficient to establish the 
inherency of that result or characteristic. In re Rijckaert, 9 F.3d 1531, 1534, 28 USPQ2d 
1955, 1957 (Fed. Cir. 1993). Further, "[i]n relying upon the theory of inherency, the 
examiner must provide a basis in fact and/or technical reasoning to reasonably support the 
determination that the allegedly inherent characteristic necessarily flows from the teachings 
of the applied prior art." Ex parte Levy, 17 USPQ2d 1461, 1464 (Bd. Pat. App. & Inter. 
1990) (emphasis in original). 

B) Discussion of tiie Rejections 

1 . Claims 1 -5 are rejected as unpatentable under 35 U.S.C. I02(e^ over Wood (US 
Patent Number 6.609.1 98^ hereinafter "Wood." 

Claim 1 

Claim 1 recites: "denying submission of a second password inside the set of pages if 
the second password was previously submitted outside the set of pages; allowing submission 
of the second password inside the set of pages if the second password was not previously 
submitted outside the set of pages." 

The Examiner rehes on Wood at column 3, lines 59-60, which merely recites; "The 
information resources have individualized authentication requirements." 

Wood dejfines its authentication requirements at column 2, lines 32-35 which recites: 
"Authentication schemes (e.g., those based on passwords, certificates, biometric techniques, 
smart cards, etc.) are associated with trust levels and environmental parameters." 



Appellant; Gary L.Bates Page 17 

Serial No.: 10/798,909 

Filed: Marehll,2004 Docket: ROC920030376US1 

Tide: Password Protection Mechanism 

Wood defines its trust levels at column 2, lines 50-56, which recites: "An entity (e.g., 
a user or an application) may initially log-on with a credential suitable for one or more 
resources in an initial resource set, but then require access to resource requiring 
authentication at higher trust level. In such case, the log-on service allows additional 
credentials to be provided to authenticate at the higher trust level." 

Wood defines its environmental parameters at column 6, lines 54-58, which recites: 
"the mapping of login credential types and authentication mechanisms to trust levels is 
influenced by envirormient information such as time of request, source of request, connection 
speed, and/or client application (e.g., browser) environment information." 

Thus, the Wood "individualized authentication requirements" are based on 
"passwords, certificates, biometric techniques, smart cards," "time of request, source of 
request, connection speed, and/or client application," and a higher trust level has additional 
credentials, none of which are related to whether or not a password as been previously 
submitted outside of a set of pages, so Wood does not teach or suggest "denying submission 
of a second password inside the set of pages if the second password was previously submitted 
outside the set of pages; allowing submission of the second password inside the set of pages 
if flie second password was not previously submitted outside the set of pages," as recited in 
claim 1. 

Further, Wood does not compare passwords that were submitted to different 
information resources. Instead, Wood processes the credentials for its client entities 
individually and not in relation to each other. For example, at column 3, lines 60-62, Wood 
"obtains a first credential for the client entity, authenticates the client entity thereby." Then, 
at column 3, line 65 and column 4, lines 1-3, Wood "obtains a second credential for the client 
entity, authenticates the client entity thereby, and upgrades the session to the second 
authentication level," but Wood does not compare its first and the second credentials, so 
Wood cannot possibly teach or suggest "denying submission of a second password inside the 
set of pages if the second password was previously submitted outside the set of pages; 
allowing submission of the second password inside the set of pages if the second password 
was not previously submitted outside the set of pages," as recited in claim 1. 
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In addition, since Wood "upgrades the session to the second authentication level" in 
response to the authentication of the "client entity" via the "second credential," as described 
at column 3, lines 67 and line 4, lines 1-2, Wood is accepting its second credential, in 
opposition to "denying submission of a second password," as recited in claim 1. 

Thus, Wood does not teach or suggest all elements of claim 1 . 



Claims 2-5 

Claims 2-5 are dependent on claim 1 and are patentable for the reasons argued above. 
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Conclnsion 

Appellant respectfully requests reversal of the above rejections. If the Board is of the 
opinion that any rejected claim may be allowable in amended form, then appellant also 
respectfully requests a statement to that effect. 



Respectfully submitted. 




Date April 21. 2009 
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8. CLAIMS APPENDIX 

1. A method comprising: 

receiving a form at a client, wherein the foim requests that a first password be 
submitted to a server, 

determining whether the first password is restricted to a set of pages, wherein the 
determining further comprises in response to each of the pages in the set being retrieved from 
the server, determining whether at least one of the pages in the set comprises a meta tag that 
includes password restriction control information that specifics an address of a domain and 
restriction of password submission to within the domain, wherein the pages in the set are 
interpreted and displayed at the client after being retrieved from the server; 

if the first password is restricted to the set of pages, denying submission of the first 
password outside the set of pages, wherein the first password is allowed to be submitted to 
the server that originated the set of pages; 

if the first password is not restricted to the set of pages, allowing submission of the 
password outside the set of pages; 

denying submission of a second password inside the set of pages if the second 
password was previously submitted outside the set of pages; 

allowing submission of the second password inside the set of pages if the second 
password was not previously submitted outside the set of pages; and 

if the at least one of the pages in the set comprises the password restriction control 
information that specifies the address of the domain and the restriction of the password 
submission to within the domain, saving the address of the domain and saving an indication 
that password use is to be restricted for all the pages in the domain. 
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2. The method of claim 1 , wherein the set of pages comprises all pages within the domain. 

3. The meftiod of claim 1, wherein the set of pages comprises a single page. 

4. The method of claim 1, further comprising: 

presenting a dialog at the client, wherein the dialog allows a user to specify an address 
of a domain for which password submission is to be restricted. 

5. The method of claim 1 , fUrther comprising: 

presenting a dialog at the client, wherein the dialog allows a user to specify an address 
of a single page for which password submission is to be restricted. 
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9. EVTOENCE APPENDIX 



None. 
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10. RELATED PROCEEDINGS APPENDIX 



None. 



